3 ms·

This is not a replacement for YubiKey, this is a system to back them up. The article says: "You can then use that key [...] as the seed to create a U2F key for

by theamk 6y ago

This is not a replacement for YubiKey, this is a system to back them up. The article says: "You can then use that key [...] as the seed to create a U2F key for two-factor authentication" Imagine that you do not trust electronics. Maybe once in the past, your PC's power supply blew up and fried every device in every USB port. Or maybe you were by the ocean once, and salt water got into your pocket and ruined every electronic device there. Or maybe you have read too much science fiction and are super afraid of terrorists setting of EMP bombs. Either way, you want a key backup which is non-electronic in nature. What are you options then? Not many. You can generate a random QR code and and print it. Or you can write down list of 13 random words, bitcoin-style. But this is still paper, so it can get lost or easily destroyed. The box of dice, on the other hand, is much bigger (so it is harder to lose), and much stronger physically -- it does not care about water damage or mold. Yes, this is not for everyone. Some people will want to backup using another electronic device, or maybe they do not care about backups at all. I'd personally use the "13 words" method if I had this problem. But I can easily imagine a person for whom the dicekeys would be the best secret backup solution.

tripletao 6y ago
Maybe, though that seems pretty fringe to me. I'd note that backing up the secret from a challenge/response token creates a big new class of attacks--it's much easier for someone to learn my secret without me realizing when that secret exists outside tamper-resistant memory. It would be better to register multiple different security tokens, or to program multiple security tokens identically and then destroy the key material afterwards (except for the copies inside the tokens).

3 ms·

This is not a replacement for YubiKey, this is a system to back them up. The article says: "You can then use that key [...] as the seed to create a U2F key for

by theamk 6y ago

tripletao 6y ago
Maybe, though that seems pretty fringe to me. I'd note that backing up the secret from a challenge/response token creates a big new class of attacks--it's much easier for someone to learn my secret without me realizing when that secret exists outside tamper-resistant memory. It would be better to register multiple different security tokens, or to program multiple security tokens identically and then destroy the key material afterwards (except for the copies inside the tokens).